CVE-2026-20223

Critical · CVSS 10.0

Cisco Secure Workload — Missing Authentication for Critical Function (CWE-306) - Unauthenticated REST API Access leading to privilege escalation to Site Admin

CVSS: 10.0; nvd
EPSS: 0.83%; 54th pct
KEV: No
Class: other; CWE-306

Description

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user. 

Search profile — drives PoC discovery

Symbols REST APISite Adminaccess validationinternal REST APIstenant boundariescrafted API requestAPI endpoint authentication

Keywords CVE-2026-20223Cisco Secure WorkloadREST API authentication bypassSite Admin privilege escalationunauthenticated API accesscisco-sa-csw-pnbsa-g8WEnuySecure Workload tenant bypassCWE-306 Cisco

Versions: <UNKNOWN>

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

HORKimhab/CVE-2026-20223 needs review

recent activity

gh_search · Python

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy

Status: enriched · ingested 2026-06-30T18:00:22.000Z · profiled 2026-06-30T18:30:14.000Z